@xenosystem/agent-sdk 0.9.10 → 0.9.13

package/ownership/evidence/PROPRIETARY-PTY-1/provenance-review.md

@@ -1,52 +1,52 @@
-# Independent Provenance Review: Xeno PTY Runtime
-
-## Review identity
-
-- Component: Xeno-owned native PTY runtime
-- Replacement milestone: PROPRIETARY-PTY-1
-- Implementation record path: `ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md`
-- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
-- Reviewer: pending
-- Domain reviewer (required): pending native/runtime security reviewer
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Evidence checks
-
-- [ ] Behavioral contract predates or is independent from implementation work.
-- [ ] Normative and public sources are listed with revisions and evidence paths.
-- [ ] Contributor source-exposure disclosures are complete.
-- [ ] Required separation/counsel decisions are attached.
-- [ ] No copied source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
-- [ ] AI inputs and human review satisfy the contributor guide.
-- [ ] Intentional incompatibilities are approved and versioned.
-- [ ] Conformance, malformed-input, security, resource-limit, and fuzz evidence meets the component gate.
-- [ ] Bundle graph, native hashes, SBOM, ownership inventory, and clean-install graph agree.
-- [ ] Licenses, patents, trademarks, and specification terms have an explicit disposition.
-
-## Similarity and provenance review method
-
-- Files and revisions reviewed: pending
-- Comparison method and tools: pending
-- Findings: pending
-- False positives and disposition: pending
-
-## Verification summary
-
-| Gate | Evidence | Result | Notes |
-| --- | --- | --- | --- |
-| Windows contract compatibility | focused PTY unit/integration suite | engineering pass | 13 tests, independent rerun pending |
-| Security/resource limits | bounded queue/buffer, hash and manifest rejection, Job Object tree cleanup, Linux ASan/UBSan campaign | engineering pass | independent native security review and coverage-guided fuzzing pending |
-| Lifecycle/soak | 25 integration cycles plus 100 Windows, 100 Linux, and 250 sanitized Linux stress iterations; active native state returns to zero | engineering pass | longer soak and platform handle tooling pending |
-| Performance envelope | dependency-free startup/throughput benchmark | engineering pass | Windows p95 42.08 ms / ~8.7 MB/s; Linux p95 17.55 ms / ~32.6 MB/s; product approval pending |
-| Cross-platform | Windows x64 and Linux x64 | partial | 12 Linux tests pass with one Windows-only assertion skipped; Windows/Linux ARM64 and macOS matrix evidence pending |
-| Artifact ownership | ownership audit and dry-run tarball | partial | unsigned development binary; signed clean install pending |
-
-## Decision
-
-- Engineering provenance decision: needs-work
-- Capability gate may be marked achieved: no
-- Public clean-room/proprietary claim approved by this review: no
-- Required follow-up: produce and observe the remaining claimed-architecture prebuilds, sign with an approved release key, run native fuzz/sanitizer and performance campaigns, collect contributor disclosures, assign independent reviewers, and attach counsel disposition.
-- Reviewer signature/date: pending
-- Counsel approval reference (required for public claim): pending
+# Independent Provenance Review: Xeno PTY Runtime
+
+## Review identity
+
+- Component: Xeno-owned native PTY runtime
+- Replacement milestone: PROPRIETARY-PTY-1
+- Implementation record path: `ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md`
+- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
+- Reviewer: pending
+- Domain reviewer (required): pending native/runtime security reviewer
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Evidence checks
+
+- [ ] Behavioral contract predates or is independent from implementation work.
+- [ ] Normative and public sources are listed with revisions and evidence paths.
+- [ ] Contributor source-exposure disclosures are complete.
+- [ ] Required separation/counsel decisions are attached.
+- [ ] No copied source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
+- [ ] AI inputs and human review satisfy the contributor guide.
+- [ ] Intentional incompatibilities are approved and versioned.
+- [ ] Conformance, malformed-input, security, resource-limit, and fuzz evidence meets the component gate.
+- [ ] Bundle graph, native hashes, SBOM, ownership inventory, and clean-install graph agree.
+- [ ] Licenses, patents, trademarks, and specification terms have an explicit disposition.
+
+## Similarity and provenance review method
+
+- Files and revisions reviewed: pending
+- Comparison method and tools: pending
+- Findings: pending
+- False positives and disposition: pending
+
+## Verification summary
+
+| Gate | Evidence | Result | Notes |
+| --- | --- | --- | --- |
+| Windows contract compatibility | focused PTY unit/integration suite | engineering pass | 13 tests, independent rerun pending |
+| Security/resource limits | bounded queue/buffer, hash and manifest rejection, Job Object tree cleanup, Linux ASan/UBSan campaign | engineering pass | independent native security review and coverage-guided fuzzing pending |
+| Lifecycle/soak | 25 integration cycles plus 100 Windows, 100 Linux, and 250 sanitized Linux stress iterations; active native state returns to zero | engineering pass | longer soak and platform handle tooling pending |
+| Performance envelope | dependency-free startup/throughput benchmark | engineering pass | Windows p95 42.08 ms / ~8.7 MB/s; Linux p95 17.55 ms / ~32.6 MB/s; product approval pending |
+| Cross-platform | Windows x64 and Linux x64 | partial | 12 Linux tests pass with one Windows-only assertion skipped; Windows/Linux ARM64 and macOS matrix evidence pending |
+| Artifact ownership | ownership audit and dry-run tarball | partial | unsigned development binary; signed clean install pending |
+
+## Decision
+
+- Engineering provenance decision: needs-work
+- Capability gate may be marked achieved: no
+- Public clean-room/proprietary claim approved by this review: no
+- Required follow-up: produce and observe the remaining claimed-architecture prebuilds, sign with an approved release key, run native fuzz/sanitizer and performance campaigns, collect contributor disclosures, assign independent reviewers, and attach counsel disposition.
+- Reviewer signature/date: pending
+- Counsel approval reference (required for public claim): pending

package/ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md

@@ -1,68 +1,68 @@
-# Runtime Boundary Decision Record: Current Xeno CLI Distributions
-
-## Identity
-
-- Component: npm Node-host profile and self-contained external-runtime profiles
-- Replacement milestone: PROPRIETARY-RUNTIME-1
-- Repository and paths: `xeno-agent-cli/scripts/build-standalone.mjs`, compatibility shell wrapper, `scripts/audit-self-contained-runtime.mjs`, release workflow, install scripts, and runtime-boundary documentation
-- Record owner: Xeno engineering, final owner assignment pending
-- Decision date (UTC): 2026-07-12
-- Status: Phase 6 decision complete; P3 explicitly declined for the current architecture and release series
-
-## Decision
-
-- The supported npm profile requires a separately installed Node.js 20 or newer host.
-- The `pkg` self-contained profile embeds Node.js, including the Node V8, libuv, OpenSSL, and zlib runtime boundary.
-- The Bun self-contained profile embeds the third-party Bun runtime and its transitive runtime components.
-- All three profiles have a maximum ownership claim of P2 after the separate P1/P2 capability and provenance gates pass.
-- The `owned-standalone-runtime` P3 capability remains `achieved: false`.
-- Current self-contained assets may not be described as P3, fully proprietary, 100% Xeno-owned, native-owned, or free of third-party runtime code.
-- Replacing `pkg` with another third-party packager or embedded runtime does not advance P3.
-
-## Installer and Packaging Audit
-
-| Surface | Actual behavior | Runtime boundary | Claim disposition |
-| --- | --- | --- | --- |
-| `scripts/install.sh` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
-| `scripts/install.ps1` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
-| `build-standalone.mjs pkg` | Compiles self-contained platform payloads with pinned `pkg` through an owned cross-platform orchestrator | Embedded Node/V8/libuv/OpenSSL/zlib | External embedded runtime; not P3 |
-| `build-standalone.mjs bun` | Compiles self-contained platform payloads with a preinstalled Bun through the same orchestrator | Embedded Bun and transitive runtime | External embedded runtime; not P3 |
-| GitHub `cli-v*` release | Publishes payloads, archives, runtime manifest, and checksums | Profile declared by `RUNTIME-BOUNDARY.json` | Release notes must state external runtime and not P3 |
-
-## Enforcement
-
-- `scripts/audit-self-contained-runtime.mjs` hashes every raw self-contained payload and writes a deterministic `RUNTIME-BOUNDARY.json`.
-- Verification fails for a missing payload, unknown packaging mode, changed payload hash, changed manifest, or ownership ceiling above P2.
-- The build script cleans the release staging directory so Bun and Node profiles cannot be mixed.
-- Target validation fails closed unless the corresponding audited PTY manifest and native payload exist.
-- Before `pkg` runs, the owned orchestrator invokes the pinned `pkg-fetch` entry point with `--force-fetch`; existing/downloaded bases must match the packager's expected SHA-256, and fetch failures terminate explicitly instead of falling back to an implicit Node.js source build.
-- The owned orchestrator writes normalized ZIP/TAR archives and SHA-256 records without Bash, `npx`, or external archive/checksum utilities.
-- The release workflow verifies the runtime manifest before uploading assets.
-- `SHA256SUMS.txt` is generated after the runtime manifest and therefore covers the claim record as well as payloads and archives.
-- Compatibility labels `standalone` and `native` remain in scripts/environment values, but documentation defines them as self-contained distribution labels rather than ownership claims.
-
-## Verification Evidence
-
-- Runtime-boundary self-test creates a synthetic PE payload, writes and verifies the Node profile, mutates the payload, and confirms verification rejects it.
-- Focused install-documentation tests assert the profile scripts, workflow gate, manifest name, and not-P3 language.
-- A clean Debian Node 24.18.0 run builds the exact SDK and CLI candidates, packages Linux x64 and Windows x64, executes and verifies the Linux payload, and reaches only the required unsigned-native release blocker.
-- A clean Debian Linux arm64 run under QEMU builds the exact SDK and CLI candidates, packages and executes `xeno-linux-arm64`, verifies owned PTY/preview plus bubblewrap containment, and reaches only the required unsigned-native release blocker. See `docs/compliance/linux-arm64-package-candidate.md`.
-- Focused packaging tests verify Linux arm64 and Windows arm64 base-prefetch arguments plus unsupported-target rejection. A transient GitHub `503` was reproduced as the historical trigger for implicit source compilation; the new preflight converts that condition into a bounded explicit failure.
-- The exact clean cross-built Windows payload executes under its real `xeno-win-x64.exe` name with healthy process-tree, ConPTY, owned-preview, and ownership-policy diagnostics.
-- Two consecutive same-environment Windows runs produce byte-identical executable, ZIP, runtime manifest, and checksum files. Independent-environment reproducibility remains a P4 gate.
-- CLI build, typecheck, release-package smoke, compliance, and artifact inventory must still pass for each release candidate.
-- No current release artifact was published by this implementation work.
-
-## P3 Reconsideration Gate
-
-P3 requires either an owned native runtime rewrite or a sustained Xeno-owned JavaScript-compatible runtime, followed by cross-platform conformance, deterministic artifacts, provenance, SBOM, signing, and independent review. It is a separate multi-year program and is not part of the current P2 release target.
-
-## Handoff
-
-- Phase 6 decision complete: yes
-- P3 implementation complete: no
-- P3 evidence complete: no
-- P3 capability gate may be marked achieved: no
-- Public not-P3 boundary ready for engineering use: yes
-- Counsel/public ownership approval: pending
-- Author/date: Codex implementation assistant, 2026-07-12
+# Runtime Boundary Decision Record: Current Xeno CLI Distributions
+
+## Identity
+
+- Component: npm Node-host profile and self-contained external-runtime profiles
+- Replacement milestone: PROPRIETARY-RUNTIME-1
+- Repository and paths: `xeno-agent-cli/scripts/build-standalone.mjs`, compatibility shell wrapper, `scripts/audit-self-contained-runtime.mjs`, release workflow, install scripts, and runtime-boundary documentation
+- Record owner: Xeno engineering, final owner assignment pending
+- Decision date (UTC): 2026-07-12
+- Status: Phase 6 decision complete; P3 explicitly declined for the current architecture and release series
+
+## Decision
+
+- The supported npm profile requires a separately installed Node.js 20 or newer host.
+- The `pkg` self-contained profile embeds Node.js, including the Node V8, libuv, OpenSSL, and zlib runtime boundary.
+- The Bun self-contained profile embeds the third-party Bun runtime and its transitive runtime components.
+- All three profiles have a maximum ownership claim of P2 after the separate P1/P2 capability and provenance gates pass.
+- The `owned-standalone-runtime` P3 capability remains `achieved: false`.
+- Current self-contained assets may not be described as P3, fully proprietary, 100% Xeno-owned, native-owned, or free of third-party runtime code.
+- Replacing `pkg` with another third-party packager or embedded runtime does not advance P3.
+
+## Installer and Packaging Audit
+
+| Surface | Actual behavior | Runtime boundary | Claim disposition |
+| --- | --- | --- | --- |
+| `scripts/install.sh` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
+| `scripts/install.ps1` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
+| `build-standalone.mjs pkg` | Compiles self-contained platform payloads with pinned `pkg` through an owned cross-platform orchestrator | Embedded Node/V8/libuv/OpenSSL/zlib | External embedded runtime; not P3 |
+| `build-standalone.mjs bun` | Compiles self-contained platform payloads with a preinstalled Bun through the same orchestrator | Embedded Bun and transitive runtime | External embedded runtime; not P3 |
+| GitHub `cli-v*` release | Publishes payloads, archives, runtime manifest, and checksums | Profile declared by `RUNTIME-BOUNDARY.json` | Release notes must state external runtime and not P3 |
+
+## Enforcement
+
+- `scripts/audit-self-contained-runtime.mjs` hashes every raw self-contained payload and writes a deterministic `RUNTIME-BOUNDARY.json`.
+- Verification fails for a missing payload, unknown packaging mode, changed payload hash, changed manifest, or ownership ceiling above P2.
+- The build script cleans the release staging directory so Bun and Node profiles cannot be mixed.
+- Target validation fails closed unless the corresponding audited PTY manifest and native payload exist.
+- Before `pkg` runs, the owned orchestrator invokes the pinned `pkg-fetch` entry point with `--force-fetch`; existing/downloaded bases must match the packager's expected SHA-256, and fetch failures terminate explicitly instead of falling back to an implicit Node.js source build.
+- The owned orchestrator writes normalized ZIP/TAR archives and SHA-256 records without Bash, `npx`, or external archive/checksum utilities.
+- The release workflow verifies the runtime manifest before uploading assets.
+- `SHA256SUMS.txt` is generated after the runtime manifest and therefore covers the claim record as well as payloads and archives.
+- Compatibility labels `standalone` and `native` remain in scripts/environment values, but documentation defines them as self-contained distribution labels rather than ownership claims.
+
+## Verification Evidence
+
+- Runtime-boundary self-test creates a synthetic PE payload, writes and verifies the Node profile, mutates the payload, and confirms verification rejects it.
+- Focused install-documentation tests assert the profile scripts, workflow gate, manifest name, and not-P3 language.
+- A clean Debian Node 24.18.0 run builds the exact SDK and CLI candidates, packages Linux x64 and Windows x64, executes and verifies the Linux payload, and reaches only the required unsigned-native release blocker.
+- A clean Debian Linux arm64 run under QEMU builds the exact SDK and CLI candidates, packages and executes `xeno-linux-arm64`, verifies owned PTY/preview plus bubblewrap containment, and reaches only the required unsigned-native release blocker. See `docs/compliance/linux-arm64-package-candidate.md`.
+- Focused packaging tests verify Linux arm64 and Windows arm64 base-prefetch arguments plus unsupported-target rejection. A transient GitHub `503` was reproduced as the historical trigger for implicit source compilation; the new preflight converts that condition into a bounded explicit failure.
+- The exact clean cross-built Windows payload executes under its real `xeno-win-x64.exe` name with healthy process-tree, ConPTY, owned-preview, and ownership-policy diagnostics.
+- Two consecutive same-environment Windows runs produce byte-identical executable, ZIP, runtime manifest, and checksum files. Independent-environment reproducibility remains a P4 gate.
+- CLI build, typecheck, release-package smoke, compliance, and artifact inventory must still pass for each release candidate.
+- No current release artifact was published by this implementation work.
+
+## P3 Reconsideration Gate
+
+P3 requires either an owned native runtime rewrite or a sustained Xeno-owned JavaScript-compatible runtime, followed by cross-platform conformance, deterministic artifacts, provenance, SBOM, signing, and independent review. It is a separate multi-year program and is not part of the current P2 release target.
+
+## Handoff
+
+- Phase 6 decision complete: yes
+- P3 implementation complete: no
+- P3 evidence complete: no
+- P3 capability gate may be marked achieved: no
+- Public not-P3 boundary ready for engineering use: yes
+- Counsel/public ownership approval: pending
+- Author/date: Codex implementation assistant, 2026-07-12

package/ownership/evidence/PROPRIETARY-RUNTIME-1/provenance-review.md

@@ -1,32 +1,32 @@
-# Independent Provenance Review: Runtime Boundary Decision
-
-## Review Identity
-
-- Component: current npm and self-contained runtime profiles
-- Replacement milestone: PROPRIETARY-RUNTIME-1
-- Implementation record: `ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md`
-- Reviewer: pending independent reviewer
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Current Evidence Status
-
-- [x] The npm Node-host boundary is explicitly disclosed.
-- [x] The `pkg` profile is classified as an embedded Node/V8/libuv/OpenSSL/zlib runtime.
-- [x] The Bun profile is classified as an embedded external Bun runtime without unsupported transitive-absence claims.
-- [x] Product language and release notes are bounded to maximum P2 and explicitly reject P3.
-- [x] A deterministic artifact-hash manifest and tamper self-test are present.
-- [ ] A real release candidate for every claimed platform has been built and audited.
-- [ ] Per-build SBOMs and native import/symbol inventories have been reconciled.
-- [ ] Reproducibility has been demonstrated in two clean environments.
-- [ ] Independent engineering and counsel review is signed.
-
-## Decision
-
-- Engineering boundary decision: needs independent review
-- Phase 6 no-P3 strategy may be used internally: yes
-- P3 capability gate may be marked achieved: no
-- Public claim that the standalone runtime is proprietary: no
-- Required follow-up: audit real release payloads, reconcile SBOM/import evidence, and obtain independent/counsel approval
-- Reviewer signature/date: pending
-- Counsel approval reference: pending
+# Independent Provenance Review: Runtime Boundary Decision
+
+## Review Identity
+
+- Component: current npm and self-contained runtime profiles
+- Replacement milestone: PROPRIETARY-RUNTIME-1
+- Implementation record: `ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md`
+- Reviewer: pending independent reviewer
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Current Evidence Status
+
+- [x] The npm Node-host boundary is explicitly disclosed.
+- [x] The `pkg` profile is classified as an embedded Node/V8/libuv/OpenSSL/zlib runtime.
+- [x] The Bun profile is classified as an embedded external Bun runtime without unsupported transitive-absence claims.
+- [x] Product language and release notes are bounded to maximum P2 and explicitly reject P3.
+- [x] A deterministic artifact-hash manifest and tamper self-test are present.
+- [ ] A real release candidate for every claimed platform has been built and audited.
+- [ ] Per-build SBOMs and native import/symbol inventories have been reconciled.
+- [ ] Reproducibility has been demonstrated in two clean environments.
+- [ ] Independent engineering and counsel review is signed.
+
+## Decision
+
+- Engineering boundary decision: needs independent review
+- Phase 6 no-P3 strategy may be used internally: yes
+- P3 capability gate may be marked achieved: no
+- Public claim that the standalone runtime is proprietary: no
+- Required follow-up: audit real release payloads, reconcile SBOM/import evidence, and obtain independent/counsel approval
+- Reviewer signature/date: pending
+- Counsel approval reference: pending

package/ownership/evidence/PROPRIETARY-TOOLCHAIN-1/implementation-record.md

@@ -1,53 +1,53 @@
-# Toolchain Boundary Record: Current Xeno Build System
-
-## Identity
-
-- Component: TypeScript/Node development, test, analysis, bundling, packaging, native-build, and CI toolchain
-- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
-- Repository and paths: CLI/SDK manifests and lockfiles, build/test configs, native build scripts, CI workflows, and generated compliance inventories
-- Record owner: Xeno engineering, final owner assignment pending
-- Audit date (UTC): 2026-07-12
-- Status: boundary inventory and anti-overclaim controls complete; P4 implementation not started
-
-## Current Boundary
-
-- Product target: P2.
-- P4 capability gate: false.
-- Generated CLI development graph at audit: 397 records, including 392 build-only and 5 external-runtime records.
-- Unique development package names at audit: 324.
-- Direct tool groups: TypeScript/type contracts, tsup/esbuild, TSX, Vite/Vitest/Rollup, ESLint/typescript-eslint, npm/lockfile tooling, and @yao-pkg/pkg.
-- Native and hosted boundaries: operating-system compilers/SDKs/linkers, Node/N-API headers, shell/PowerShell, and GitHub Actions remain external.
-- License review: seven installed development entries require review; no claim resolves those entries automatically.
-
-## Controls Added
-
-- `@yao-pkg/pkg@6.21.0` is exact and committed to the lockfile.
-- The cross-platform owned packaging orchestrator invokes the exact installed `@yao-pkg/pkg@6.21.0` entry point directly; release packaging does not use `npx` or download a moving package compiler.
-- Deterministic ZIP/TAR generation, checksums, target validation, and runtime-manifest orchestration are Xeno-owned control logic.
-- Optional Bun packaging requires a preinstalled executable and never downloads Bun in the build script.
-- `scripts/verify-toolchain-boundary.mjs` reconciles direct manifest requests to lockfile versions, generated development records, license-review entries, and the false P4 policy gate.
-- `npm run compliance:toolchain` writes and immediately verifies `docs/compliance/toolchain-boundary.json`.
-- Human-readable scope and exit criteria are in `docs/TOOLCHAIN_BOUNDARIES.md`.
-
-## P4 Replacement Scope
-
-P4 requires owned language parsing/type analysis/transpilation, bundling and source maps, test runtime/assertions/mocking/coverage, static analysis, package resolution/integrity/packing/publication, executable packaging, native build orchestration, and deterministic provenance. The accepted OS/compiler/SDK/hosted-CI boundary must be approved before implementation.
-
-## Verification Evidence
-
-- Toolchain boundary write/verify passes against the current lock, policy, ownership graph, and license inventory.
-- The packaging control path passes focused deterministic archive and PE-import tests, a clean Debian dual-target run, exact Windows cross-built execution, and same-environment byte comparison.
-- CLI build and TypeScript checks pass with the sibling SDK junction restored.
-- CLI compliance reports zero ownership violations; artifact-inclusive audit reports 927 records and zero violations.
-- These results prove classification, control-path behavior, and same-environment reproducibility only. They do not prove P4 or independent-environment byte reproducibility.
-- No release was published by this work.
-
-## Handoff
-
-- Phase 7 inventory and claim boundary complete: yes
-- P4 implementation complete: no
-- P4 evidence complete: no
-- P4 capability gate may be marked achieved: no
-- Ready to scope a separately funded compiler/toolchain program: yes
-- Counsel/public P4 approval: pending
-- Author/date: Codex implementation assistant, 2026-07-12
+# Toolchain Boundary Record: Current Xeno Build System
+
+## Identity
+
+- Component: TypeScript/Node development, test, analysis, bundling, packaging, native-build, and CI toolchain
+- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
+- Repository and paths: CLI/SDK manifests and lockfiles, build/test configs, native build scripts, CI workflows, and generated compliance inventories
+- Record owner: Xeno engineering, final owner assignment pending
+- Audit date (UTC): 2026-07-12
+- Status: boundary inventory and anti-overclaim controls complete; P4 implementation not started
+
+## Current Boundary
+
+- Product target: P2.
+- P4 capability gate: false.
+- Generated CLI development graph at audit: 397 records, including 392 build-only and 5 external-runtime records.
+- Unique development package names at audit: 324.
+- Direct tool groups: TypeScript/type contracts, tsup/esbuild, TSX, Vite/Vitest/Rollup, ESLint/typescript-eslint, npm/lockfile tooling, and @yao-pkg/pkg.
+- Native and hosted boundaries: operating-system compilers/SDKs/linkers, Node/N-API headers, shell/PowerShell, and GitHub Actions remain external.
+- License review: seven installed development entries require review; no claim resolves those entries automatically.
+
+## Controls Added
+
+- `@yao-pkg/pkg@6.21.0` is exact and committed to the lockfile.
+- The cross-platform owned packaging orchestrator invokes the exact installed `@yao-pkg/pkg@6.21.0` entry point directly; release packaging does not use `npx` or download a moving package compiler.
+- Deterministic ZIP/TAR generation, checksums, target validation, and runtime-manifest orchestration are Xeno-owned control logic.
+- Optional Bun packaging requires a preinstalled executable and never downloads Bun in the build script.
+- `scripts/verify-toolchain-boundary.mjs` reconciles direct manifest requests to lockfile versions, generated development records, license-review entries, and the false P4 policy gate.
+- `npm run compliance:toolchain` writes and immediately verifies `docs/compliance/toolchain-boundary.json`.
+- Human-readable scope and exit criteria are in `docs/TOOLCHAIN_BOUNDARIES.md`.
+
+## P4 Replacement Scope
+
+P4 requires owned language parsing/type analysis/transpilation, bundling and source maps, test runtime/assertions/mocking/coverage, static analysis, package resolution/integrity/packing/publication, executable packaging, native build orchestration, and deterministic provenance. The accepted OS/compiler/SDK/hosted-CI boundary must be approved before implementation.
+
+## Verification Evidence
+
+- Toolchain boundary write/verify passes against the current lock, policy, ownership graph, and license inventory.
+- The packaging control path passes focused deterministic archive and PE-import tests, a clean Debian dual-target run, exact Windows cross-built execution, and same-environment byte comparison.
+- CLI build and TypeScript checks pass with the sibling SDK junction restored.
+- CLI compliance reports zero ownership violations; artifact-inclusive audit reports 927 records and zero violations.
+- These results prove classification, control-path behavior, and same-environment reproducibility only. They do not prove P4 or independent-environment byte reproducibility.
+- No release was published by this work.
+
+## Handoff
+
+- Phase 7 inventory and claim boundary complete: yes
+- P4 implementation complete: no
+- P4 evidence complete: no
+- P4 capability gate may be marked achieved: no
+- Ready to scope a separately funded compiler/toolchain program: yes
+- Counsel/public P4 approval: pending
+- Author/date: Codex implementation assistant, 2026-07-12

package/ownership/evidence/PROPRIETARY-TOOLCHAIN-1/provenance-review.md

@@ -1,32 +1,32 @@
-# Independent Provenance Review: Development Toolchain Boundary
-
-## Review Identity
-
-- Component: current Xeno development toolchain
-- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
-- Boundary record: `ownership/evidence/PROPRIETARY-TOOLCHAIN-1/implementation-record.md`
-- Reviewer: pending independent reviewer
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Current Evidence Status
-
-- [x] Direct tool requests reconcile to committed lockfile versions.
-- [x] The generated development graph and review-required licenses are recorded.
-- [x] Audited release paths prohibit network-fallback `npx` resolution.
-- [x] Documentation explicitly rejects P4 and byte-reproducibility claims.
-- [ ] Non-Xeno language/type/bundle/test/lint/package tools have been replaced.
-- [ ] Accepted OS/compiler/SDK/CI boundaries have been approved.
-- [ ] Two clean environments produce byte-identical artifacts.
-- [ ] Signed provenance and independent tool-binary review are complete.
-- [ ] Counsel has approved the P4 ownership language.
-
-## Decision
-
-- Engineering boundary decision: accurate for current P2 work
-- P4 implementation decision: not approved or implemented
-- P4 capability gate may be marked achieved: no
-- Public P4/proprietary-toolchain claim approved: no
-- Required follow-up: approve platform boundaries, fund the compiler/toolchain program, replace each capability group, prove clean reproducibility, and complete independent/counsel review
-- Reviewer signature/date: pending
-- Counsel approval reference: pending
+# Independent Provenance Review: Development Toolchain Boundary
+
+## Review Identity
+
+- Component: current Xeno development toolchain
+- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
+- Boundary record: `ownership/evidence/PROPRIETARY-TOOLCHAIN-1/implementation-record.md`
+- Reviewer: pending independent reviewer
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Current Evidence Status
+
+- [x] Direct tool requests reconcile to committed lockfile versions.
+- [x] The generated development graph and review-required licenses are recorded.
+- [x] Audited release paths prohibit network-fallback `npx` resolution.
+- [x] Documentation explicitly rejects P4 and byte-reproducibility claims.
+- [ ] Non-Xeno language/type/bundle/test/lint/package tools have been replaced.
+- [ ] Accepted OS/compiler/SDK/CI boundaries have been approved.
+- [ ] Two clean environments produce byte-identical artifacts.
+- [ ] Signed provenance and independent tool-binary review are complete.
+- [ ] Counsel has approved the P4 ownership language.
+
+## Decision
+
+- Engineering boundary decision: accurate for current P2 work
+- P4 implementation decision: not approved or implemented
+- P4 capability gate may be marked achieved: no
+- Public P4/proprietary-toolchain claim approved: no
+- Required follow-up: approve platform boundaries, fund the compiler/toolchain program, replace each capability group, prove clean reproducibility, and complete independent/counsel review
+- Reviewer signature/date: pending
+- Counsel approval reference: pending